Home / termux / termux-packages
AI Slop Code Risk Monitor

termux/termux-packages

SlopCodeMonitor badge for termux/termux-packages Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A package build system for Termux.

1.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for termux/termux-packages, a Shell project with 17,276 GitHub stars. SynthScan examined 241,378 lines of code across 4461 source files, recording 359 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 1.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.5
Adjusted Signal
1.5
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
17.3K
Stars
Shell
Language
241.4K
Lines of Code
4.5K
Files
359
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 347 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 6 finding(s).

Agent Over-Engineering Ratio 0.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 25 finding(s).

PR Review Velocity Impact 7.9/100 · LOW

Which changes need focused human review? 359 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 20LOW 339

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 359 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block288 hits · 237 pts
SeverityFileLineSnippetContext
LOWbuild-package.sh281# Optional host build. Not to be overridden by packages.COMMENT
LOWdisabled-packages/termux-x11/termux-x11.c1#include <unistd.h>COMMENT
LOWdisabled-packages/qt5-qtquickcontrols/build.sh21 ##COMMENT
LOWndk-patches/langinfo.h41#define _NL_ITEM_INDEX(nl) ((nl) & 0x3ff)COMMENT
LOWndk-patches/langinfo.h61#define ABDAY_5 19COMMENT
LOWndk-patches/langinfo.h81#define ABMON_6 39COMMENT
LOWscripts/generate-apt-packages-list.sh1#!/usr/bin/env bashCOMMENT
LOWscripts/check-repository-health.js1#!/usr/bin/env nodeCOMMENT
LOWscripts/setup-termux.sh81COMMENT
LOWscripts/properties.sh1# shellcheck shell=bashCOMMENT
LOWscripts/properties.sh21# Additionally, the Termux packages build system is an unsafe mess ofCOMMENT
LOWscripts/properties.sh41# - `invalid_termux_prefix_paths`: Path variable must not matchCOMMENT
LOWscripts/properties.sh61##COMMENT
LOWscripts/properties.sh121##COMMENT
LOWscripts/properties.sh141# separators `/` are not allowed. The path component characters mustCOMMENT
LOWscripts/properties.sh161# with a `/`). Duplicate or trailing path separators `/` are notCOMMENT
LOWscripts/properties.sh181# specific Filesystem Hierarchy Standard paths or paths used by TermuxCOMMENT
LOWscripts/properties.sh201# Same reasoning as `TERMUX_REGEX__INVALID_TERMUX_ROOTFS_PATHS`,COMMENT
LOWscripts/properties.sh221##COMMENT
LOWscripts/properties.sh241# - https://cs.android.com/android/platform/superproject/+/android-14.0.0_r1:frameworks/base/core/java/android/content/pCOMMENT
LOWscripts/properties.sh341# Following is a list of `TERMUX_` variables that are safe to modify when forking.COMMENT
LOWscripts/properties.sh361# - `TERMUX_API_APP__PACKAGE_NAME`.COMMENT
LOWscripts/properties.sh381TERMUX__LNAME="${TERMUX__NAME,,}"COMMENT
LOWscripts/properties.sh401# `TERMUX__NAME`, `TERMUX_APP__PACKAGE_NAME` and urls.**COMMENT
LOWscripts/properties.sh421COMMENT
LOWscripts/properties.sh441##COMMENT
LOWscripts/properties.sh461# - `TERMUX_APP__NAMESPACE`.COMMENT
LOWscripts/properties.sh481# The directory set will be deleted by `clean.sh` if `TERMUX__PREFIX`COMMENT
LOWscripts/properties.sh501COMMENT
LOWscripts/properties.sh521#COMMENT
LOWscripts/properties.sh541COMMENT
LOWscripts/properties.sh561__termux_build_props__add_variables_validator_actions "TERMUX__CORE_DIR" "safe_absolute_path"COMMENT
LOWscripts/properties.sh581# - https://man7.org/linux/man-pages/man7/unix.7.htmlCOMMENT
LOWscripts/properties.sh601##COMMENT
LOWscripts/properties.sh621##COMMENT
LOWscripts/properties.sh641##COMMENT
LOWscripts/properties.sh661# Termux subdirectory path for `TERMUX__APPS_DIR_BY_UID`.COMMENT
LOWscripts/properties.sh681# numbers and must not start with a `0`.COMMENT
LOWscripts/properties.sh701COMMENT
LOWscripts/properties.sh721##COMMENT
LOWscripts/properties.sh741##COMMENT
LOWscripts/properties.sh761###########COMMENT
LOWscripts/properties.sh781# the `TERMUX_APP__DATA_DIR` if compiling packages for the AndroidCOMMENT
LOWscripts/properties.sh801#COMMENT
LOWscripts/properties.sh821COMMENT
LOWscripts/properties.sh841TERMUX_ANDROID_HOME="$TERMUX__HOME" # Deprecated alternative variable for `TERMUX__HOME`COMMENT
LOWscripts/properties.sh861# Default value: `usr`COMMENT
LOWscripts/properties.sh881# are installed under the `usr` subdirectory under rootfs, like underCOMMENT
LOWscripts/properties.sh901# `TERMUX__PREFIX`, or a custom directory other than `usr`. In thisCOMMENT
LOWscripts/properties.sh921# - `TERMUX__PREFIX` must not be equal to `TERMUX__HOME` andCOMMENT
LOWscripts/properties.sh961##COMMENT
LOWscripts/properties.sh981# Termux `glibc` prefix directory path under `TERMUX__PREFIX`COMMENT
LOWscripts/properties.sh1001#COMMENT
LOWscripts/properties.sh1021# commands will fail with exit code 1 without any error on `stderr`,COMMENT
LOWscripts/properties.sh1081##COMMENT
LOWscripts/properties.sh1101#COMMENT
LOWscripts/properties.sh1121COMMENT
LOWscripts/properties.sh1141##COMMENT
LOWscripts/properties.sh1161##COMMENT
LOWscripts/properties.sh1181TERMUX__PREFIX__MULTI_LIB_SUBDIR="lib32"COMMENT
228 more matches not shown…
Redundant / Tautological Comments18 hits · 26 pts
SeverityFileLineSnippetContext
LOWbuild-all.sh23# Set TERMUX_INSTALL_DEPS to -s unless set to -iCOMMENT
LOWbuild-package.sh456# Check if the package is in the compiled listCOMMENT
LOWbuild-package.sh472# Check if the package is in the compiling listCOMMENT
LOWscripts/run-docker.sh213# Set traps to ensure that the process started with docker exec and all its children are killed.COMMENT
LOWscripts/utils/termux_reuse_pr_build_artifacts.sh70 # Print output only in the case of errorCOMMENT
LOWscripts/utils/termux_reuse_pr_build_artifacts.sh85 # Check if we can perform CI fast path.COMMENT
LOWscripts/utils/termux/package/termux_package.sh9# Check if package on device builds are supported by checkingCOMMENT
LOWscripts/utils/termux/package/termux_package.sh34# Check if a specific version of a package has been built by checkingCOMMENT
LOWscripts/utils/termux/package/termux_package.sh59# Check if the package name has a prefix called `glibc` or `glibc32`.COMMENT
LOWscripts/updates/internal/termux_github_graphql.sh108 | "GIT|\($pkgName)|\($tag)" # Print resultsCODE
LOWscripts/updates/utils/termux_pkg_upgrade_version.sh42 # Check if it isn't the full version and add ':'.COMMENT
LOWpackages/libheif/build.sh33 # Check if SONAME is properly set:COMMENT
LOWpackages/liblzma/build.sh29 # Check if SONAME is properly set:COMMENT
LOWpackages/libplacebo/build.sh44 # Check if SONAME is properly set:COMMENT
LOWpackages/libxml2/build.sh63 # Check if SONAME is properly set:COMMENT
LOWpackages/libjpeg-turbo/build.sh21 # Check if SONAME is properly set:COMMENT
LOWpackages/libexpat/build.sh36 # Check if SONAME is properly set:COMMENT
LOWpackages/zstd/build.sh46 # Check if SONAME is properly set:COMMENT
Self-Referential Comments8 hits · 24 pts
SeverityFileLineSnippetContext
MEDIUMbuild-package.sh420# Create the build deb file. Not to be overridden by package scripts.COMMENT
MEDIUMbuild-package.sh424# Create the build .pkg.tar.xz file. Not to be overridden by package scripts.COMMENT
MEDIUMdisabled-packages/unnethack/build.sh22 # Create a host build for the makedefs binaryCOMMENT
MEDIUMscripts/setup-cgct.sh28# Creating a directory for CGCT in tmpCOMMENT
MEDIUMpackages/prowlarr/build.sh36 # Create a host wrapper for yarn since the one in $TERMUX_PREFIX/binCOMMENT
MEDIUMpackages/radarr/build.sh28 # Create a host wrapper for yarn since the one in $TERMUX_PREFIX/binCOMMENT
MEDIUMpackages/zsh/build.sh128 # Create a symlink for zsh-$version instead of the hardlink:COMMENT
MEDIUMpackages/sonarr/build.sh28 # Create a host wrapper for yarn since the one in $TERMUX_PREFIX/binCOMMENT
Hyper-Verbose Identifiers19 hits · 20 pts
SeverityFileLineSnippetContext
LOWscripts/buildorder.py40def parse_build_file_dependencies_with_vars(path, vars):CODE
LOW⚡scripts/buildorder.py56def parse_build_file_dependencies(path):CODE
LOW⚡scripts/buildorder.py60def parse_build_file_antidependencies(path):CODE
LOW⚡scripts/buildorder.py64def parse_build_file_excluded_arches(path):CODE
LOWscripts/buildorder.py77def parse_build_file_variable(path, var):CODE
LOWscripts/buildorder.py88def parse_build_file_variable_bool(path, var):CODE
LOWscripts/buildorder.py91def add_prefix_glibc_to_pkgname(name):CODE
LOWscripts/buildorder.py215def resolve_package_dependencies(all_packages, pkgs_map):CODE
LOWscripts/buildorder.py231def read_packages_from_directories(directories, fast_build_mode, full_buildmode):CODE
LOWscripts/buildorder.py352def generate_target_buildorder(target_path, pkgs_map, fast_build_mode):CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py74def find_leading_assignment_end(lines: list[str]) -> int:STRING
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py103def has_blacklisted_top_level_assignment(lines: list[str]) -> bool:CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py115def starts_with_leading_assignment(lines: list[str]) -> bool:CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py132def first_top_level_target_index(lines: list[str]) -> int | None:CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py172def first_scope_target_index_with_scopes(CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py185def find_scope_jumbo_import_index_with_scopes(CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py210def scope_import_indent_with_scopes(CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py222def find_scope_jumbo_import_index(lines: list[str], scope_depth: int) -> int | None:CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py350def module_path_from_build_file(path: Path, root: Path) -> str:CODE
Decorative Section Separators6 hits · 18 pts
SeverityFileLineSnippetContext
MEDIUMpackages/foundry/build.sh58 # ── 1. Boost components ────────────────────────────────────────────────COMMENT
MEDIUMpackages/foundry/build.sh76 # ── 2. libsolutil link line ────────────────────────────────────────────COMMENT
MEDIUMpackages/foundry/build.sh82 # ── 3. boost::process ──────────────────────────────────────────────────COMMENT
MEDIUMpackages/foundry/build.sh100 # ── 4. Configure ───────────────────────────────────────────────────────COMMENT
MEDIUMpackages/foundry/build.sh173 # ── 5. Build ───────────────────────────────────────────────────────────COMMENT
MEDIUMpackages/foundry/build.sh178 # ── 6. Install ─────────────────────────────────────────────────────────COMMENT
Slop Phrases4 hits · 12 pts
SeverityFileLineSnippetContext
MEDIUMpackages/timidity++/timidity.cfg46# alternatively, you can use the fluid-soundfont:COMMENT
MEDIUM.github/workflows/codeql.yml47 # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize howCOMMENT
MEDIUMx11-packages/openbox/configs/rc.xml706 # used by a shell. you can use * to match any characters and ? to matchCOMMENT
MEDIUMx11-packages/openbox/configs/rc.xml746 # you can use fractions such as 1/2 or percentages such as 75% in whichCOMMENT
Deep Nesting6 hits · 6 pts
SeverityFileLineSnippetContext
LOWscripts/buildorder.py64CODE
LOWscripts/buildorder.py215CODE
LOWscripts/buildorder.py231CODE
LOWscripts/get_hash_from_file.py5CODE
LOWx11-packages/movit/make_bundled_shaders.py16CODE
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py154CODE
Fake / Example Data5 hits · 5 pts
SeverityFileLineSnippetContext
LOWx11-packages/libadwaita/gir/Adw-1.xml882 <property name="placeholder" type="GtkWidget" flags="1073742051"/>CODE
LOWx11-packages/libadwaita/gir/Adw-1.xml1219 <property name="placeholder" type="GtkWidget" flags="1073742051"/>CODE
LOWx11-packages/gtk3/gir/Gtk-3.0.xml3097 <member name="GTK_UI_MANAGER_PLACEHOLDER" nick="placeholder" value="8"/>CODE
LOWx11-packages/gtk4/gir/Gtk-4.0.xml1213 <member name="GTK_ACCESSIBLE_PROPERTY_PLACEHOLDER" nick="placeholder" value="10"/>CODE
LOWx11-packages/gtk2/gir/2.24.33/Gtk-2.0.xml713 <member name="GTK_UI_MANAGER_PLACEHOLDER" nick="placeholder" value="8"/>CODE
AI Slop Vocabulary2 hits · 4 pts
SeverityFileLineSnippetContext
MEDIUMpackages/delve/build.sh1TERMUX_PKG_HOMEPAGE=https://github.com/go-delve/delveCODE
MEDIUMpackages/delve/build.sh8TERMUX_PKG_SRCURL=https://github.com/go-delve/delve/archive/refs/tags/v${TERMUX_PKG_VERSION}.tar.gzCODE
Example Usage Blocks2 hits · 3 pts
SeverityFileLineSnippetContext
LOWdisabled-packages/qt5-qmake/termux-build-qmake.sh6## Usage:COMMENT
LOWscripts/generate-apt-packages-list.sh10# Usage:COMMENT
Unused Imports1 hit · 1 pts
SeverityFileLineSnippetContext
LOW…ckages/chromium-host-tools/scripts/rewrite_gn_jumbo.py15CODE